Creating CI/build and run policies for container image labels / Dockerfile instructions

patriciar — Wed, 29 May 2024 10:17:19 GMT

We have been deploying custom build and run policies via Checkov (targeting Terraform resources, i.e.: VMs). We do this via the Governance pane in the Prisma Cloud "Cloud Security" component. These policies check usage of tags. Cool.

Now we're trying to create an equivalent set of policies for Container Images Labels. Specifically, we want to create guardrails and alerting around the usage of container images labels.

Anyone have an idea on how to create custom policies for this with Prisma Cloud? (either from CSPM/governance or the CWP/runtime compliance checks, the documentation and examples is not loads extensive and support seems to be missing at times).

Thoughts?

Re: Creating CI/build and run policies for container image labels / Dockerfile instructions

JNeytchev — Thu, 14 Nov 2024 20:28:15 GMT

Hi Patriciar,

If you would like to check for existence of labels in a Dockerfile at build time you can write a simple custom check, for example to check for org and purpose labels:

metadata: id: "MyLabelCheck" name: "Ensure org and purpose labels are present" category: "APPLICATION_SECURITY" definition: and: - cond_type: attribute resource_types: - LABEL attribute: value operator: contains value: "purpose=" - cond_type: attribute resource_types: - LABEL attribute: value operator: contains value: "org="

That will check against the LABEL directive in Dockerfile, for example

FROM node:alpine LABEL org=Accounting purpose=Appserver RUN useradd -m appuser USER appuser WORKDIR /usr/src/app ..etc..

Then you can tell checkov to load the additional check from the directory where you placed the yaml file

checkov [other paramereters] --framework dockerfile --external-checks-dir my_yaml_checks_dir/ --check MyLabelCheck

Hope this helps

topic Creating CI/build and run policies for container image labels / Dockerfile instructions in Prisma Cloud Discussions

Creating CI/build and run policies for container image labels / Dockerfile instructions

Re: Creating CI/build and run policies for container image labels / Dockerfile instructions